# US 11,451,524 B2 · Network system interface for controlling confidential information

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,451,524 B2
- Document ID: US11451524B2
- Status: Granted
- Kind: B2
- Application number: 16/695,485
- Filed: 2019-11-26
- Published: 2020-05-28
- Granted: 2022-09-20
- Earliest claimed: 2018-11-28
- Assignees: Hitachi, Ltd.
- Applicants: Hitachi, Ltd.
- Inventors: Tatsuya Tomaru
- Web page: https://patentgrep.com/patent/US11451524B2

## CPC

- H04L 63/0272: {Virtual private networks}
- H04L 63/0464: {using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it}
- H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones}
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes}
- H04L 63/0471: {applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

In a network system that connects a site 100 and a site 200 to each other via an open network and a closed network, an interface 131 performs control so that format information of confidential information can pass but the confidential information cannot pass therethrough between a computer 111 and a computer 121. An interface 231 performs control so that format information of confidential information can pass but the confidential information cannot pass therethrough between a computer 211 and a computer 221.

## Claims

### Claim 1

A network system including a first site and a second site connected to each other via an open network and a closed network, wherein
the first site includes
a first computer,
a second computer,
a first interface connecting the first computer and the second computer to each other, and
an encryption/decryption unit connected to the second computer, and
the second site includes
a third computer,
a fourth computer,
a second interface connecting the third computer and the fourth computer to each other, and
a decryption/encryption unit connected to the fourth computer,
the first computer and the third computer belong to the open network,
the second computer and the fourth computer belong to the closed network,
the first interface performs control so that format information of first confidential information passes through the first interface but the first confidential information does not pass through the first interface between the first computer and the second computer,
the second interface performs control so that format information of second confidential information passes through the second interface but the second confidential information does not pass through the second interface between the third computer and the fourth computer,
the encryption/decryption unit and the decryption/encryption unit are connected to a wide area network, and form a virtually closed network using encryption in the wide area network,
for the open network, the first site and the second site are connected to each other via the wide area network,
for the closed network, the first site and the second site are connected to each other via the virtually closed network,
the encryption/decryption unit and the decryption/encryption unit each include a dedicated circuit through which the first and second confidential information is passed without being passed through either of the first and second interfaces.

### Claim 2 (depends on 1)

The network system according to claim 1, wherein
the encryption/decryption unit is provided between the second computer and the wide area network, so that the second computer is separated from the wide area network, and
the decryption/encryption unit is provided between the fourth computer and the wide area network, so that the fourth computer is separated from the wide area network.

### Claim 3 (depends on 1)

The network system according to claim 1, wherein:
the first interface, the second computer, and the encryption/decryption unit form a first package;
the second interface, the fourth computer, and the decryption/encryption unit form a second package;
the first package is connected to the virtually closed network via the first computer; and
the second package is connected to the virtually closed network via the third computer.

### Claim 4 (depends on 3)

The network system according to claim 3, wherein
the encryption/decryption unit in the first package is connected to the first computer, and
the decryption/encryption unit in the second package is connected to the third computer.

### Claim 5 (depends on 1)

The network system according to claim 1, further comprising:
a first package obtained by packaging the first interface, the second computer, and the encryption/decryption unit; and
a second package obtained by packaging the second interface, the fourth computer, and the decryption/encryption unit, wherein
the first package is connected to the virtually closed network via a first router, and
the second package is connected to the virtually closed network via a second router.

### Claim 6 (depends on 5)

The network system according to claim 5, wherein
the encryption/decryption unit in the first package is connected to the first router, and
the decryption/encryption unit in the second package is connected to the second router.